Inside the code for Libbeat，Beat系列工具使用该函数：

//
    // Output event stats
    //
    batches *monitoring.Uint // total number of batches processed by output
    events  *monitoring.Uint // total number of events processed by output

    acked      *monitoring.Uint // total number of events ACKed by output
    failed     *monitoring.Uint // total number of events failed in output
    active     *monitoring.Uint // events sent and waiting for ACK/fail from output
    duplicates *monitoring.Uint // events sent and waiting for ACK/fail from output
    dropped    *monitoring.Uint // total number of invalid events dropped by the output
    tooMany    *monitoring.Uint // total number of too many requests replies from output

    //
    // Output network connection stats
    //
    writeBytes  *monitoring.Uint // total amount of bytes written by output
    writeErrors *monitoring.Uint // total number of errors on write

    readBytes  *monitoring.Uint // total amount of bytes read
    readErrors *monitoring.Uint // total number of errors while waiting for response on output
}

当你在Elastic中查询Libbeat的结果时（见下文），Output Errors是从初始时间戳的readErrors + writeErrors和最新时间戳的readErrors + writeErrors之间的测量增量中得出的。根据代码注解，Output Errors是遇到错误的网络包的数量。
下面的例子使用apm-server作为beat类型，但是你可以根据自己的需要替换它。它不会给予你 * 为什么 * 你有网络错误，但是它会把数据分开，这样你就可以识别是读错误还是写错误。

GET _search

    "query": {
      "bool": {
        "filter": [
          {
            "bool": {
              "should": [
                {
                  "term": {
                    "data_stream.dataset": "beats.stats"
                  }
                },
                {
                  "term": {
                    "metricset.name": "stats"
                  }
                },
                {
                  "term": {
                    "type": "beats_stats"
                  }
                }
              ]
            }
          },
          {
            "term": {
              "cluster_uuid": "CLUSTER_UUID"
            }
          },
          {
            "range": {
              "beats_stats.timestamp": {
                "format": "epoch_millis",
                "gte": 1665053615330,
                "lte": 1665054515330
              }
            }
          },
          {
            "bool": {
              "must": {
                "term": {
                  "beats_stats.beat.type": "apm-server"
                }
              }
            }
          }
        ]
      }
    },
    "collapse": {
      "field": "beats_stats.metrics.beat.info.ephemeral_id",
      "inner_hits": {
        "name": "earliest",
        "size": 1,
        "sort": [
          {
            "beats_stats.timestamp": {
              "order": "asc",
              "unmapped_type": "long"
            }
          },
          {
            "@timestamp": {
              "order": "asc",
              "unmapped_type": "long"
            }
          }
        ]
      }
    },
    "sort": [
      {
        "beats_stats.beat.uuid": {
          "order": "asc",
          "unmapped_type": "long"
        }
      },
      {
        "timestamp": {
          "order": "desc",
          "unmapped_type": "long"
        }
      }
    ]
}